Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 24 Sep 2002 12:45:12 -0700

Is this a new requirement that ingress filtering should check both the
CoA
and the Mac address ? According to RFC2267, you are supposed to just
check
the IP address and I assume that is what most routers do. 

-mohan

>   > 
>   > I don't think we are breaking it any more than
>   > allowing HoA and reverse tunneling
>   > from FA in MIPv4. Are we ?
> 
> => Do networks deploying MIPv4 run ingress filtering
> if there was no reverse tunnelling from the FA?
> 
> I don't think MIPv4 is a good example :)
> 
>   > I think it is harder to spoof an arbitrary combination
>   > of off-link prefix and iid.
>   > Here is what a malicious node needs to do I think.
>   > 
>   > - spoof the off-link prefix. How ? by monitoring the traffic ?
>   >    How is prefix length determined ? 
> 
> => Who cares? It's spoofing the whole thing. Anyway,
> the IPv6 prefix length is 64.
> 
> The off-link prefix
>   >    is never advertised on the new router's link. If the attacker
>   >    moved from the link where the off-link prefix is valid,
>   >    then he would know the off-link prefix.
> 
> => He doesn't need to, see above.
> 
>   > - spoof the MAC address. How ? Through ND.
> 
> => Monitoring traffic. No need for ND.
> 
>   > - keep looking for the "window" to open. That is, guess when
>   >    the new router would allow traffic with previous CoA.
>   > - send packets with the spoofed address
>   > 
>   > This is hard work with questionable incentives, especially if
>   > the tunnel lifetime is kept short. 
> 
> => As I said earlier, in a real situation there is probably 
> more than one MN doing a handover, so there is more than one 
> of those addresses.
> 
> Hesham
>

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 21:00:17 -0700

Mohan,

We're talking about making changes in the access router. Routers today don't
support PrxyRtSol or PrxyRtAdv.

            jak

----- Original Message -----
From: "Mohan Parthasarathy" <[email-masked]>
To: "Hesham Soliman (EAB)" <[email-masked]>; "Rajeev Koodli"
<[email-masked]>
Cc: "James Kempf" <[email-masked]>; <[email-masked]>
Sent: Tuesday, September 24, 2002 12:45 PM
Subject: RE: [mobile-ip] fastv6 and CoAs

-mohan